Commvault vulnerabilities

A vulnerability in the network messaging layer of Commvault involves improper handling of highly compressed data affecting service availability. Customers are advised to upgrade to the resolved maintenance release.

A vulnerability in QAPI (part of Commvault) involves a stack-based buffer overflow affecting service availability. Customers are advised to upgrade to the resolved maintenance release.

A vulnerability in MediaAgent (part of Commvault) involves a heap-based buffer overflow affecting service availability. Customers are advised to upgrade to the resolved maintenance release.

A vulnerability in CVFS (part of Commvault) involves a missing authentication condition affecting command execution. Customers are advised to upgrade to the resolved maintenance release.

Cvlaunchd contained a missing authorization issue affecting command execution authorization. Software customers should upgrade to the resolved maintenance release. Update all Commvault installations, including Commserve, Webserver, Command Center, Media Agents, Clients and HyperScale X.